# Oracle Cloud Infrastructure

> An OCI resource handler connects to a single Oracle Cloud region and manages its servers and images

---

Site [llms.txt](/llms.txt)

---

Cloud Management Platform (CMP) authenticates to OCI with an API signing key rather than a password, so set the key up in Oracle Cloud before adding the handler. Oracle Linux images also disable password-based authentication, so plan to use SSH keys to access provisioned servers.

## Before you begin

Collect the following from Oracle Cloud. The credentials dialog needs all of it, so keep it to hand:

- The **region** to connect to.
- Your **user OCID** and **tenancy OCID**, and the **compartment OCID** if you want the handler scoped to one compartment and its sub-compartments.
- An **API signing key** in PEM format, its **fingerprint**, and its passphrase if set. [Manage an OCI server with SSH keys](#manage-an-oci-server-with-ssh-keys) below generates a key pair you can use for this.

## Add an OCI resource handler

1. Go to **Admin** > **Resource Handlers**, select **Add**, then select **Oracle Cloud Infrastructure**, under **Public Cloud**.
1. Fill in the credentials dialog and select **Continue**.
1. Enter a name and an optional description, then select **Done**.

| Field | Description |
| --- | --- |
| **Region** | Required. The OCI region this handler connects to. |
| **User OCID** | Required. The OCID of the user the API signing key belongs to. |
| **Certificate Fingerprint** | Required. The fingerprint OCI shows after you upload the public key. |
| **Key File** | Required. Paste the private key in PEM format. |
| **Passphrase** | The passphrase protecting the private key. Leave it empty if the key has none. |
| **Tenancy OCID** | Required. The OCID of your tenancy. |
| **Compartment OCID** | Optional. Scopes the handler to this compartment and its sub-compartments: environments offer only those compartments, and VM, image, and network discovery follow them. If empty, CMP uses the tenancy. |

## OCI parameters

The following parameters are imported and may appear on the order form:

| Parameter | Description |
| --- | --- |
| **Compartment** | Required. The compartment to provision into. |
| **Shape** | Required. The instance shape, which sets the server's size. The list narrows to the shapes the selected OS build's image supports. |
| **Availability Domain** | Required. The availability domain to deploy into. The list narrows to the domains available for the selected network. |
| **Fault Domain** | The fault domain within the availability domain. The list narrows once an availability domain is chosen. |
| **Network Security Groups** | The network security groups to apply. More than one can be selected, and the list narrows to the groups available for the selected network. |
| **Assign Public IP** | Gives the instance a public IP address. |
| **OCPUs** | The number of OCPUs, which only flexible shapes use. The field appears on the order form only when the selected shape is flexible. |
| **Memory (GB)** | The memory in GB, which only flexible shapes use. The field appears on the order form only when the selected shape is flexible. |

## Manage an OCI server with SSH keys

OCI Oracle Linux images disable password authentication, so give CMP an SSH key to place on the servers it builds. There are five steps: generate a key pair, add the public key to OCI, add the private key to CMP, create an OS build for your image, then point the image at the key.

### 1. Generate a key pair in PEM format

From your terminal, run the following. CMP cannot read a passphrase-protected SSH key, so generate the key without one.

```bash
openssl genrsa -out oci_api_key.pem 2048
openssl rsa -pubout -in oci_api_key.pem -out oci_api_key_public.pem
cat oci_api_key_public.pem
```

The last command prints the public key, which you need in the next step. You add the private key, `oci_api_key.pem`, to CMP in step 3.

### 2. Add the public key to OCI

1. Log in to the OCI portal at [cloud.oracle.com](https://cloud.oracle.com).
1. Open **User Settings** from the profile menu at the top right.
1. Select **Add Public Key** and paste in the public key.
1. Keep the key fingerprint and the user OCID as shown by OCI. Both are required for the credentials dialog.

### 3. Add the private key to CMP

1. Go to **Admin** > **SSH Keys** and select **New SSH Key**.
1. Enter a **Global Key Name**, and paste the contents of `oci_api_key.pem` from step 1 into **Key material**. CMP requires PEM format.

### 4. Create an OS build for your OCI image

1. Go to **Admin** > **OS Builds** and select **Add**.
1. Give it a name, a description, and an OS family if applicable, then select **Add**. CMP opens the new OS build.
1. On the **Overview** tab, select **Edit**, choose your OCI environment under **Environments**, and select **Save changes**.
1. Open the **Images** tab and add your image.

### 5. Specify the image user and SSH key

1. Open your OCI resource handler and select the **Images** tab.
1. Select the edit icon under **Credentials** for your image.
1. Set the username to `opc`, the default user on Oracle Linux images.
1. In **Key name**, select the key you added in step 3, then select **Save**.

## Related

- [Resource handlers](/docs/cmp/configure/infrastructure/resource-handlers/): the technologies CMP connects to, and how to add one.
- [SSH keys](/docs/cmp/configure/access-and-security/security/ssh-keys/): how CMP stores key material and which handlers use it.
- [OS Builds](/docs/cmp/configure/infrastructure/os-builds/): how an OS build maps an image to an environment.